高手来帮忙删除病毒啊!!

流浪无限

新手上路
注册
2003-11-11
消息
1,921
荣誉分数
4
声望点数
0
最近用诺顿查毒,发现WINDOWS\SYSTEM32文件下有一文件感染病毒--regedlt32.dll. 病毒名称:backdoor.gravbird.诺顿杀不了,也删除不了,不知道现在除了FORMAT,还有什么办法呢?:o :o
 
其实你知道病毒的名字在搜索器上查一下就行了
转篇帖子给你

关了服务在杀毒
To end the Trojan process:
Press Ctrl+Alt+Delete once.
Click Task Manager.
Click the Processes tab.
Double-click the Image Name column header to alphabetically sort the processes.
Scroll through the list and look for Svch0st.exe.
If you find the file, click it, and then click End Process.
Exit the Task Manager.

然后杀毒

杀好后清除注册表
Click Start, and then click Run. (The Run dialog box appears.)

Type regedit

Then click OK. (The Registry Editor opens.)


Navigate to each of these the keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

NOTE: All the keys do not exist on all the systems.


For each one, in the right pane, delete any of the following values:

"svchost"="%System%\Svch0st.exe"
"winlogon"="%System%\Winlogon.exe"
"system"="%System%\Explorer.exe"


If you are running Windows NT/2000/XP, navigate to the key:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows


In the right pane, delete the value:

run %system%\svch0st.EXE


Exit the registry editor.

如果你是95、98或者win me
If you are running Windows 95/98/Me, follow these steps:

The function you perform depends on your operating system:
Windows 95/98: Go to step b.
Windows Me: If you are running Windows Me, the Windows Me file-protection process may have made a backup copy of the Win.ini file that you need to edit. If this backup copy exists, it will be in the C:\Windows\Recent folder. Symantec recommends deleting this file before continuing with the steps in this section. To do this:
Start Windows Explorer.
Browse to and select the C:\Windows\Recent folder.
In the right pane, select the Win.ini file and delete it. The Win.ini file will be regenerated when you save your changes to it in step f.


Click Start, and then click Run.

Type the following:

edit c:\windows\win.ini

and then click OK. (The MS-DOS Editor opens.)

NOTE: If Windows is installed in a different location, make the appropriate path substitution.


In the [windows] section of the file, look for a line similar to:

run=C:\WINDOWS\SYSTEM\SVCH0ST.EXE


If this line exists, delete the entire line.

Click File, and then click Save.

Click File, and then click Exit.
 
后退
顶部